Posted by Geoff Berrow on 04/13/06 09:55

Message-ID: <1144909681.379717.249460@t31g2000cwb.googlegroups.com> from
lawrence k contained the following:

>The function that returns this checks to query to see if it contains
>the words ALTER, DROP, EMPTY, GRANT, UPDATE, INSERT, and a bunch of
>others. It calls die() if it sees any of those words.

The general advice seems to be to ban everything that is not allowed
rather than to allow anything which is not banned.

I think I'd construct the query in code from the input variables, after
having sanitised the input using mysql_real_escape_string()



--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Back to original message]